image:
  name: ps5-kali
  distribution: debian
  # Release images use Kali's last snapshot for stable, repeatable builds.
  release: kali-last-snapshot
  description: Kali Linux XFCE desktop
  architecture: x86_64

source:
  downloader: debootstrap
  url: https://kali.download/kali
  variant: minbase
  keyserver: keyserver.ubuntu.com
  keys:
  - 0x827C8569F2518CC677FECA1AED65462EC8D5E4C5

packages:
  manager: apt
  update: true
  cleanup: true

  repositories:
  - name: sources.list
    url: |-
      deb https://kali.download/kali kali-last-snapshot main contrib non-free non-free-firmware
    architectures:
    - amd64

  sets:
  - packages:
    # Full Kali desktop and toolset
    - kali-desktop-xfce
    - kali-linux-everything
    - kali-defaults
    - kali-defaults-desktop
    - kali-themes
    - kali-wallpapers-2026
    - kali-wallpapers-all
    - kali-menu
    - kali-tweaks
    - kali-undercover

    # Display / GPU / audio
    - lightdm
    - lightdm-gtk-greeter
    - xserver-xorg
    - xserver-xorg-video-amdgpu
    - dbus-x11
    - x11-xserver-utils
    - mesa-vulkan-drivers
    - pipewire
    - pipewire-pulse
    - wireplumber
    - pavucontrol

    # Networking and remote access
    - network-manager
    - network-manager-gnome
    - openssh-server
    - iputils-ping
    - ntpsec
    - iw
    - wpasupplicant
    - wireless-regdb

    # Firmware and PS5 boot support
    - firmware-linux
    - firmware-linux-nonfree
    - firmware-amd-graphics
    - firmware-realtek
    - firmware-atheros
    - firmware-mediatek
    - firmware-misc-nonfree
    - initramfs-tools
    - kexec-tools
    - kmod
    - busybox
    - zstd
    - systemd-zram-generator

    # Base system utilities
    - sudo
    - cloud-guest-utils
    - parted
    - e2fsprogs
    - usbutils
    - pciutils
    - rfkill
    - util-linux
    - curl
    - wget
    - git
    - ca-certificates
    - build-essential
    - bc
    - bison
    - flex
    - libssl-dev
    - libelf-dev
    - vim
    - nano
    - tmux
    - firefox-esr
    # Ghidra 12.1 requires JDK 21. The full Kali set also installs newer JDKs.
    - openjdk-21-jdk
    action: install

files:
- path: /etc/hostname
  generator: hostname

- path: /etc/hosts
  generator: hosts

- path: /etc/machine-id
  generator: dump

- path: /etc/kernel/postinst.d/zz-update-boot
  generator: copy
  source: /tmp/build-staging/zz-update-boot
  mode: "0755"

- path: /etc/fstab
  generator: copy
  source: /tmp/build-staging/fstab

- path: /etc/apt/trusted.gpg.d/kali-archive-keyring.asc
  generator: copy
  source: /tmp/build-staging/kali-archive-keyring.asc

- path: /usr/local/sbin/grow-rootfs
  generator: copy
  source: /tmp/build-staging/grow-rootfs
  mode: "0755"

- path: /etc/systemd/system/grow-rootfs.service
  generator: copy
  source: /tmp/build-staging/grow-rootfs.service

- path: /opt/debs/
  generator: copy
  source: /tmp/build-staging/debs

actions:
- trigger: post-unpack
  action: |-
    #!/bin/bash
    set -eux
    rm -f /var/lib/apt/lists/*InRelease /var/lib/apt/lists/*Release /var/lib/apt/lists/*Packages* || true
    echo 'Acquire::Retries "10";' > /etc/apt/apt.conf.d/80retry
    cat > /etc/apt/trusted.gpg.d/kali-archive-keyring.asc <<'EOF'
    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQINBGgBJJUBEADlMTZVDCjrSXIAuYfL3VZt8OoplUdw3mSPlhIjZQmIo2sdzvAF
    EMSCQ+vWeD4VqV9tBtiVx6j8VSfyW18YHHAkvajWDRg5hPLf80wGxrtXYu+vj3Ri
    5dOMhrl9fHKIifPOoV3pFTtOk0dB9lkcmtNzjWgwOJduLbjjraE1BBKqc0uaXDCa
    RJnPYkQuJQcZxmZVFAo9NP7KSAL1zMvutAd0R3WeMaWpT22nGa3rJj4kj25zV6Kn
    qGnv5kQaY2cTlQHnp6EbiLe5sCE7zIOp5CjwIJhyCyn4zT8KqGB8Sw8PEi9mYlSY
    wbGzzfAAbBk7Y8xbmvRrkrHzU74jH0iMK566QVu2yl3Dz0hrlliV6vGn2ZWu7qmh
    lwXSb+q4u46tDbFjdUjYJG2upx5vOm5SewD9snLB4YN2e2qDeQgY16AfpkJa51+u
    PwTeDCbfuQu3irLWcGRZgpOBgsxqCtpZBmF6ED7L8tntoyjZ9WeB8FnTcv7hx5J1
    IPCO4K5TvW0SX6ZKp1Jusbkn5hrrFTjOJHhIDVdioM/wYDKkqJ9e25oGAqPkJYRY
    euonU1teK+EOLM7ZIbalhukrw0bgYl9UJRxQMLEhZzoiiCLLiv3oWHAQGFclP+1E
    zXgbLBviFAU4+DMXfhA6vy8BmS9oTpleS1p3/EOwf2rX/yt4qF7IW9ZXuQARAQAB
    tEBLYWxpIExpbnV4IEFyY2hpdmUgQXV0b21hdGljIFNpZ25pbmcgS2V5ICgyMDI1
    KSA8ZGV2ZWxAa2FsaS5vcmc+iQJUBBMBCgA+FiEEgnyFafJRjMZ3/soa7WVGLsjV
    5MUFAmgF7tkCGwMFCQWkfeUFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ7WVG
    LsjV5MXcjw//XeI6OXY7VcH+hXRcT7W49AwqRfmSaSEWs474G2DQR9UppzvkFCab
    uiWl5jrlkeGbVFsiBruJfIlCdYMMnPk8gEm/SEhVRqcZVOjYCWcMlSVB6oU+6tgW
    jKPPRDELiq7mTl8S4sEdvUxpsWoMqEQZ1+CsJsw+p+TARGNIrUUdL9hTOoOUpvue
    nKNEEfzbKvLk2gj2tKOgr1HcDmVbbmRsL87+UYq1JvA0OzJ0KrhBdTZHJWchAJwa
    p+UUog2XrzvXYXWBPfQLsNVkFirmVd1B5vonj3OeNlVU51YriRQ4P4onLrwlfha8
    vUGeNJw/ihXTQFpvmF7fFSRa7Pr5YfWkDZ4BGuEB+kSycu2PMWCXXHdY++cMIlRf
    uUg/wvzcwAkS99DJ0EAiOun0oypE5+r5HwfaI9IrJlgZMPlFctyBIGVg2DFZCdLH
    VHG1Voq/CU2tgWvWyuHXHVlUiZiWJoj7BbVa88Gj+VyvB/md1xBh0ScmfH4uGgnX
    hpLFPIVuR1SJYarovVmtFhAjbqbrAA4Q9utpOeOOVDMD5tuq856/lLh+SWPkRsUy
    ZJTwz1Nh0rJ/UJOMSo4ljkkr53iR/IM4woAAaP+0hkZoIDSbVVW5Im1Yj461exl4
    0ltMBMym2KZk/IFOTloSfW7hMmGlqaLfQEH1ryHefIIpkgKJa6WgVxA=
    =f+tz
    -----END PGP PUBLIC KEY BLOCK-----
    EOF
    apt-get update

- trigger: post-update
  action: |-
    #!/bin/bash
    set -eux
    passwd -l root

- trigger: post-packages
  action: |-
    #!/bin/bash
    set -eux

    # Default user (kali/kali)
    useradd -m -G sudo -s /bin/bash kali
    echo "kali:kali" | chpasswd

    # The image is assembled inside Docker, where the generated hostname is
    # otherwise the temporary container ID. Use a stable PS5 hostname.
    printf 'ps5\n' > /etc/hostname
    if grep -q '^127\.0\.1\.1' /etc/hosts; then
      sed -i 's/^127\.0\.1\.1.*/127.0.1.1 ps5/' /etc/hosts
    else
      printf '127.0.1.1 ps5\n' >> /etc/hosts
    fi

    # Ghidra 12.1 requires JDK 21, while Kali Rolling may select a newer Java
    # as the system default. Keep its desktop launcher on the supported JDK.
    test -x /usr/lib/jvm/java-21-openjdk-amd64/bin/java
    sed -i 's|^JAVA_HOME_OVERRIDE=.*|JAVA_HOME_OVERRIDE=/usr/lib/jvm/java-21-openjdk-amd64|' /usr/share/ghidra/support/launch.properties

    # LightDM autologin into XFCE
    mkdir -p /etc/lightdm/lightdm.conf.d
    cat > /etc/lightdm/lightdm.conf.d/50-ps5-autologin.conf <<'EOF'
    [Seat:*]
    autologin-user=kali
    autologin-user-timeout=0
    user-session=xfce
    EOF

    # SSH is installed for opt-in remote access. Keep it disabled while the
    # distributed image still has public default local credentials.
    sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/'               /etc/ssh/sshd_config
    sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config

    systemctl set-default graphical.target
    systemctl disable ssh.service || true
    systemctl disable ssh.socket || true
    systemctl enable NetworkManager
    systemctl enable lightdm

    # PS5 systems may boot without a useful hardware clock. Keep the shared
    # image timezone-neutral and synchronize after a network connection exists.
    ln -sf /usr/share/zoneinfo/Etc/UTC /etc/localtime
    printf 'Etc/UTC\n' > /etc/timezone
    # Android USB tethering may provide IPv4 only. The default pool returned
    # one unreachable IPv4 peer in PS5 testing; these independent IPv4 peers
    # responded and preserve multi-source time validation.
    sed -i '/^pool [0-3]\.debian\.pool\.ntp\.org /s/^/# PS5 replaced: /' /etc/ntpsec/ntp.conf
    cat >> /etc/ntpsec/ntp.conf <<'EOF'

    # PS5 USB-tether-friendly IPv4 time sources
    server -4 time.cloudflare.com iburst
    server -4 time.google.com iburst
    server -4 time.apple.com iburst
    server -4 time.windows.com iburst
    EOF
    systemctl enable ntpsec.service

    # zram swap: half of RAM, zstd compressed
    printf '[zram0]\nzram-size = ram / 2\ncompression-algorithm = zstd\n' > /etc/systemd/zram-generator.conf

    # Avoid PS5 display sleep/blanking during first boot demos.
    install -d -m 0755 /home/kali/.config/autostart
    cat > /home/kali/.config/autostart/ps5-display.desktop <<'EOF'
    [Desktop Entry]
    Type=Application
    Name=PS5 Display Defaults
    Exec=sh -c 'xset s off -dpms; xset s noblank'
    X-GNOME-Autostart-enabled=true
    EOF
    chown -R kali:kali /home/kali

- trigger: post-files
  action: |-
    #!/bin/bash
    set -eux
    systemctl enable grow-rootfs.service
    mkdir -p /boot/efi

    # This USB image uses zram, not a disk-backed hibernation device. Avoid
    # embedding a temporary build-container device as a resume target.
    mkdir -p /etc/initramfs-tools/conf.d
    printf 'RESUME=none\n' > /etc/initramfs-tools/conf.d/resume

    dpkg -i /opt/debs/*.deb
    rm -rf /opt/debs
    # kali-linux-everything installs a generic Kali kernel. Keep updates from
    # replacing the PS5-patched kernel used by the loader.
    dpkg-query -W -f='${binary:Package} ${db:Status-Status}\n' 'linux-image-*' 2>/dev/null \
      | awk '$2 == "installed" { print $1 }' \
      | xargs -r apt-mark hold
    apt-mark hold linux-ps5 || true

    KVER=$(ls -1t /lib/modules | head -1)
    depmod -a "$KVER"

    # PS5 internal WiFi uses the Marvell/NXP IW620 at PCI ID 1b4b:2b56. Build
    # the PS5-patched NXP mwifiex module for the installed PS5 kernel. Firmware
    # is console-provided by ps5-linux-loader on the boot partition, so a boot
    # service copies it into /lib/firmware before loading the module.
    IW620_SRC=/tmp/ps5-iw620-mwifiex
    IW620_PATCHES=/tmp/ps5-linux-mwifiex
    IW620_NXP_REF=a5fe4e194bf99315e349d81d77d6dfacec70757a
    IW620_PATCH_REF=5cfd063449f27e2f8a7d17c814a3bb21c27aa903
    rm -rf "$IW620_SRC" "$IW620_PATCHES"
    git clone https://github.com/nxp-imx/mwifiex.git "$IW620_SRC"
    git -C "$IW620_SRC" checkout "$IW620_NXP_REF"
    git clone https://github.com/ps5-linux/ps5-linux-mwifiex.git "$IW620_PATCHES"
    git -C "$IW620_PATCHES" checkout "$IW620_PATCH_REF"
    git -C "$IW620_SRC" apply "$IW620_PATCHES/ps5-iw620.patch"
    make -C "$IW620_SRC" CONFIG_OBJTOOL= KERNELDIR="/lib/modules/$KVER/build" ARCH=x86 -j"$(nproc)"
    test -f "$IW620_SRC/mlan.ko"
    test -f "$IW620_SRC/moal.ko"
    install -d "/lib/modules/$KVER/extra/ps5-iw620"
    install -m 0644 "$IW620_SRC/mlan.ko" "/lib/modules/$KVER/extra/ps5-iw620/mlan.ko"
    install -m 0644 "$IW620_SRC/moal.ko" "/lib/modules/$KVER/extra/ps5-iw620/moal.ko"
    install -d /etc/modprobe.d /usr/local/sbin /etc/systemd/system /usr/share/doc/ps5-iw620
    cat > /etc/modprobe.d/ps5-iw620.conf <<'EOF'
    # PS5 IW620 mwifiex
    # Prevent udev from auto-loading moal before the loader-provided firmware is
    # copied from the boot partition. ps5-iw620.service loads it explicitly.
    blacklist moal
    blacklist mlan
    softdep moal pre: cfg80211 mlan
    options moal fw_name=nxp/pcieuartiw620_combo_v1.bin pcie_int_mode=1 drv_mode=1 cfg80211_wext=4 sta_name=mlan ext_scan=0 auto_fw_reload=0 wifi_reset_config=0 sched_scan=0 ps_mode=2 auto_ds=2 amsdu_disable=1
    EOF
    cat > /usr/local/sbin/ps5-iw620-load <<'EOF'
    #!/bin/sh
    set -eu

    FW_NAME=nxp/pcieuartiw620_combo_v1.bin
    FW_DST=/lib/firmware/$FW_NAME
    FW_SRC=

    for candidate in "/boot/efi/lib/$FW_NAME" "/boot/lib/$FW_NAME" "$FW_DST"; do
      if [ -f "$candidate" ]; then
        FW_SRC="$candidate"
        break
      fi
    done

    if [ -z "$FW_SRC" ]; then
      FW_SRC="$(find /boot /boot/efi -path "*/$FW_NAME" -type f 2>/dev/null | head -n 1)"
    fi

    if [ -n "$FW_SRC" ] && [ -f "$FW_SRC" ]; then
      install -D -m 0644 "$FW_SRC" "$FW_DST"
    fi

    if [ ! -f "$FW_DST" ]; then
      echo "PS5 IW620 firmware not found on the boot partition; skipping WiFi load"
      exit 0
    fi

    # If udev raced us and loaded the module before firmware was copied, reload
    # it so firmware init can succeed.
    modprobe -r moal mlan 2>/dev/null || true
    modprobe cfg80211 || true
    modprobe moal
    rfkill unblock all 2>/dev/null || true
    nmcli radio wifi on 2>/dev/null || true
    EOF
    chmod 0755 /usr/local/sbin/ps5-iw620-load
    cat > /etc/systemd/system/ps5-iw620.service <<'EOF'
    [Unit]
    Description=Load PS5 IW620 internal WiFi
    RequiresMountsFor=/boot/efi
    Wants=systemd-udev-settle.service
    After=local-fs.target boot-efi.mount systemd-udev-settle.service
    Before=NetworkManager.service network-pre.target

    [Service]
    Type=oneshot
    ExecStart=/usr/local/sbin/ps5-iw620-load
    RemainAfterExit=yes

    [Install]
    WantedBy=multi-user.target
    EOF
    cat > /usr/share/doc/ps5-iw620/BUILDINFO <<EOF
    NXP mwifiex ref: $IW620_NXP_REF
    ps5-linux-mwifiex ref: $IW620_PATCH_REF
    Kernel: $KVER
    Module options: fw_name=nxp/pcieuartiw620_combo_v1.bin pcie_int_mode=1 drv_mode=1 cfg80211_wext=4 sta_name=mlan ext_scan=0 auto_fw_reload=0 wifi_reset_config=0 sched_scan=0 ps_mode=2 auto_ds=2 amsdu_disable=1
    EOF
    depmod -a "$KVER"
    systemctl enable ps5-iw620.service
    rm -rf "$IW620_SRC" "$IW620_PATCHES"

    grep -qxF amdgpu /etc/initramfs-tools/modules || printf '\namdgpu\n' >> /etc/initramfs-tools/modules
    printf 'MODULES=most\nBUSYBOX=y\n' > /etc/initramfs-tools/conf.d/ps5-amdgpu
    update-initramfs -c -k "$KVER"
    /etc/kernel/postinst.d/zz-update-boot "$KVER"

mappings:
  architecture_map: debian